A detection engineer wants to identify lateral movement within the network. The engineer has access to endpoint logs that include process creation, network connections, and authentication events. Which analytical approach would best detect an attacker using a compromised account to run remote commands on multiple workstations?

Search for registry modifications on all workstations

Baseline the number of running processes on each workstation

Monitor file system changes on the domain controller

Correlate authentication events with process creation and network connections from the same source host

An analyst is investigating a possible malware infection and needs to determine which executable was launched, what files it created, and which registry keys it modified. Which endpoint data sources are most directly needed?

Process creation logs, file system logs, and registry logs

Windows Event Logs only, including Security and System logs

Performance counters, memory dumps, and driver logs

Network connection logs, DNS logs, and authentication logs

What is the primary purpose of tuning a detection rule's threshold?

To reduce false positives while maintaining detection of true threats

To eliminate all alerts from the environment

To increase the volume of alerts for better visibility

A detection engineer is building a rule to detect malware persistence via a Windows service. The engineer has access to process creation logs, registry event logs, and file system logs. Which detection logic is most likely to identify a new service created by an unusual process?

Alert when any process writes to the Windows\System32 directory

Alert when a process creates a service (e.g., via sc.exe or the Service Control Manager) and the service binary is written to a non-standard location

Alert when a new process is spawned by the Service Control Manager

Alert when the registry key for services is modified

GIAC Certified Detection Analyst

Domain 4Objective 1

Endpoint Analytics GCDA Practice Questions (Page 1)

Part of the Endpoint and User Analytics domain, which makes up ~25% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~13–20 in this domain), expect 7–10 from this objective — we provide 43 practice questions to prepare you well beyond it. (estimate)

43questions here

9free pages

5concepts

Questions 1–5

1application · medium
A detection engineer wants to identify lateral movement within the network. The engineer has access to endpoint logs that include process creation, network connections, and authentication events. Which analytical approach would best detect an attacker using a compromised account to run remote commands on multiple workstations?
Select an answer first
2application · medium
An analyst is investigating a possible malware infection and needs to determine which executable was launched, what files it created, and which registry keys it modified. Which endpoint data sources are most directly needed?
Select an answer first
3foundation · easy
What is the primary purpose of tuning a detection rule's threshold?
Select an answer first
4application · medium
A detection engineer is building a rule to detect malware persistence via a Windows service. The engineer has access to process creation logs, registry event logs, and file system logs. Which detection logic is most likely to identify a new service created by an unusual process?
Select an answer first
5expert · hard
An analyst observes a process that was started from a user's temporary directory, then creates a service, and finally makes an outbound connection to an IP address that is not on any threat intelligence list. Which detection use case is most directly indicated?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCDA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCDA” is a trademark of its owner, used for identification only.